Attackers Pose as IT Support on Microsoft Teams, Abuse AD CS to Steal Company Data

Attackers impersonating IT support staff on Microsoft Teams convinced employees to grant remote access to their computers. Once inside, they exploited misconfigured Active Directory Certificate Services (AD CS) to obtain authentication certificates for privileged accounts, including domain controllers. Microsoft investigated two separate intrusions using this technique, at least one of which resulted in significant data theft. The attack chain combines social engineering via a trusted enterprise communication platform with abuse of PKI infrastructure to escalate privileges. This highlights the risk of over-permissive AD CS configurations and the growing misuse of Microsoft Teams as an attack vector.